The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e/ | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e/ | Exploit Third Party Advisory |
Configurations
History
30 May 2025, 16:55
Type | Values Removed | Values Added |
---|---|---|
First Time |
Cozmoslabs
Cozmoslabs profile Builder |
|
CWE | CWE-434 | |
CPE | cpe:2.3:a:cozmoslabs:profile_builder:*:*:*:*:*:wordpress:*:* | |
References | () https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e/ - Exploit, Third Party Advisory |
21 Nov 2024, 09:49
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e/ - |
01 Aug 2024, 14:00
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
29 Jul 2024, 14:12
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
29 Jul 2024, 06:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-07-29 06:15
Updated : 2025-05-30 16:55
NVD link : CVE-2024-6366
Mitre link : CVE-2024-6366
CVE.ORG link : CVE-2024-6366
JSON object : View
Products Affected
cozmoslabs
- profile_builder
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type